For approximately the past five years telephone companies and carriers in the telecommunications industry have been migrating toward an SS7 based signaling network, which is a common channel signaling network. This is a departure from what is traditionally called inband signaling, which relied on tone signals within the actual voice circuits to allow one switch to notify another switch of an incoming call. Common channel signals, such as an SS7 based signal system, use dedicated channels to pass digital messages between systems for call setup, call control, call routing, and other functions. These dedicated channels are a separate network from the network of circuits that carries the actual voice and data signals. An SS7 network can be thought of as a separate switching system which is used prior to, during, and at the end of the actual call for the purpose of routing control information. Whenever two switches or elements in the SS7 network have to pass call control information to one another during or prior to a phone call, they pass this data via the SS7 network.
An SS7 network traditionally has three basic types of network node elements. One of them is the Service Switching point (or SSP), which may be a central office switch, a tandem switch or an end office switch. A second principal node element is the Service Control point, or SCP. An SCP acts as a database query server for the rest of the network. An SCP is used in such applications as routing 800 calls, tracking roamers in a cellular network, and Alternate Billing Service/Line Identification Database services (or ABS/LIDB) which provide operator-type services. The third principal node element is the Signal Transfer point, or STP. An STP is essentially a packet switch which routes the messages from SSPs and SCPs to SSPs and SCPs.
Effectively, these three different types of nodes can be combined into a single node. However, in North America, they are not. An SSP performs only switch functions, an SCP only control functions, and an STP only signal transfer functions. In Europe, all of these different functions may be combined into one node.
The SS7 network, therefore, carries a great deal of information and is extremely critical to the operation of the phone system. If an SS7 network is not functioning, or if portions of it are not operating, the phone system simply cannot deliver phone calls, even though all of the voice circuits are operating properly. The capacity and complexity of the SS7 network is small in terms of circuitry and band width utilized by an end user compared to previous voice and data networks. The circuitry of the SS7 network is therefore much more critical. The actual elements in the SS7 network do not provide all the information required in network operations to manage and to determine the health and state of an SS7 network. It is therefore necessary for the telephone industry to deploy surveillance equipment to monitor the links connecting the nodes of the SS7 network.
The topology of the SS7 network is such that STPs are deployed in a mated pair configuration at geographically separate locations. Connected to a mated pair of STPs will be a set of SSPs and SCPs. This conglomeration of SSPs, SCPs and mated Pair STPs is called a cluster. Clusters are then connected by D-Quad links between STP mated pairs.
When any transaction or message is sent between two different devices on the network, it is often the case that the messages going from switch A to switch B travel one route on the network while the messages going from switch B to switch A travel a different route. The network surveillance equipment that monitors the link is designed to capture and correlate as much signalling information as possible regardless of network activity. Because of the different data paths that messages may take, it is difficult to do this correlation above what is called the transport layer when monitoring links at the STP sites. An example of an application level problem would be where a subscriber has a problem getting his calls delivered. The telephone company may attempt to fix the problem by doing a trace of all data pertaining to that subscriber's phone number, but the data may not all be located at one point. The data can be distributed randomly between two mated STPs associated with them. The data may be all in one STP, or split in some fashion, partially in one STP and partially in the other STP of the mated pair, which may be in a different city many miles away.
For applications related to one telephone number, there are a variety of ways of solving the problem of having the data located at two different nodes. Because the system is looking for just one call at a time (of all the thousands of calls that are occurring), it is possible to employ distributed triggers that trap only messages pertaining to that phone number.
However, when it is desired to go a step further by employing automated equipment that is continually monitoring the delivery of all calls in real time, problems occur. For instance, if it is desired to track how many calls are being abnormally dropped, or how many calls have abnormal completion, the problem of data being in two different places becomes formidable. In the single phone number example, it was possible to define a trigger for that phone number and when the trigger occurred, pass the corresponding information needed to coordinate tracking of the call to another device in the distributed network. However, selecting individual triggers won't work when the telephone company attempts to track all the calls all the time.
What is needed, then, is a distributed state machine that can capture all of the SS7 messages within a mated pair cluster and correlate the fragmented SS7 messages pertaining to a particular call or transaction to a single data record. Furthermore, what is needed are systems and methods for filtering out redundant or unnecessary SS7 messages in order to compile call transaction records containing a minimum amount of essential data in order to evaluate overall system performance and to diagnose system errors when they occur.
Furthermore, the ability to capture all of the SS7 messages within a mated pair cluster and correlate the fragmented SS7 messages makes other improvements to telephone network services possible. In addition to the performance monitoring applications outlined above, there is a need for systems which are capable of generating call detail records from the SS7 messages of a mated pair cluster for use in billing systems and to implement a fraud detection system for certain types of telephone calling cards. Furthermore, telephone monitoring systems are needed which enable a user to implement a call trace mechanism that can track all SS7 messages associated with a particular phone number in order to retroactively trace harassing or obscene phone calls. Finally, there is a need for a telephone monitoring system which can monitor the SS7 messages of a mated pair cluster in order to implement what is known as "mass call onset detection." Mass call onset detection is useful in circumstances where a large number of callers attempt to call a single phone number at the same time, such as where radio stations give away prizes to callers who call in immediately, thereby creating a mass call-in. Mass call onset detection applications detect this situation early as the number of SS7 messages pertaining to a particular phone number increases rapidly and alert the phone company quickly to the large number of busy conditions associated with a given phone number.